WLS Gotthard Panorama Express GOPEX is user of the online shop market place Schweizerische Südostbahn AG with Swiss Booking AG as broker
Version: 06th April 2022
1 Data controller
Swiss Booking AG (SWB) is committed to protecting your data. When processing your personal data, we adhere to all applicable data protection provisions. The data controller responsible for the storage and processing of personal data is Swiss Booking AG, Churerstrasse 54, CH-8808 Pfäffikon.
2 Name and contact details of the data protection officer
Mag. Eva Plaschke acts as the external data protection officer for Swiss Booking AG. Contact: Mag. Eva Plaschke, EQT-Unternehmensberatung e.U./Erfolg durch Qualität und Transparenz, Althofen 49, A-9131 Grafenstein, tel. +43(0) 664 829 79 49, e-mail: firstname.lastname@example.org.
3 Information about the processing of your personal data
As part of your registration or the creation of your personal account, SWB requires the following personal data (hereinafter “master data”) in order to process any potential future contract that may be concluded with you.
Date of birth
Street, building number
Post code, town/city
The details of storage and processing of personal data are set out below.
3.1 Visiting the website
Purpose: If our website is used purely for information purposes (no registration or submission of other information), personal data that your browser transmits to our server is collected. This is necessary for technical reasons: it allows you to view our website and ensures the stability and security of the website.
Legal basis: Legitimate interest
The following data is processed: IP address, date and time of request, time zone difference to GMT, content of request (specific page), access status/HTTP status code, data volume transferred, requesting website, browser, operating system and interface, language and version of browser software
Storage period: For as long as you use our website
Recipients/recipient categories: Order processors
3.2 Electronic contact requests via the website
Purpose: Processing of contact requests received via e-mail or the contact form on the website.
Legal basis: Performance of a contract, required to carry out precontractual measures, legitimate interest
The following personal data is processed: Master data
Storage period: Until the request has been responded to; if statutory data retention obligations apply, processing will be restricted until that time
Recipients/recipient categories: Order processors
3.3 Customer management, accounting, legal disputes
Purpose: Processing of personal data in connection with any business relationships with customers and suppliers as part of normal business operations, including systematic recording of all transactions relating to income and outgoings
Legal basis: Consent, performance of a contract, required to carry out precontractual measures, fulfilment of a legal obligation, legitimate interest, particularly defending, exercising or establishing legal claims, explicit consent
The following personal data is processed: Master data
Storage period: Until the termination of the business relationship or until the expiry of applicable statutory retention or limitation periods. Data will also be stored until the resolution of any legal disputes for which it is required as evidence.
Recipients/recipient categories: Event organisers, service providers, legal representatives, accountants and tax advisors, tax offices, courts and authorities
3.4 Customer relationship management and marketing
Purpose: Processing of data on existing and prospective customers for initial business contact purposes in respect of the range of products and services, provision of additional travel or leisure information as a supplementary service as part of the contractual relationship, advertising activities and newsletter mailing, customer relationship management
Legal basis: Consent, performance of a contract, required to carry out precontractual measures, fulfilment of a legal obligation, legitimate interest, particularly defending, exercising or establishing legal claims
The following personal data is processed in connection with the provision of additional travel or leisure information as a supplementary service as part of the contractual relationship and for mailing of newsletters via our website: Master data
Storage period: The data will be stored until the end of the contractual relationship unless longer contractual or statutory retention periods apply
Recipients/recipient categories: Service providers
4 Rights of affected persons
4.1You have the following rights in relation to your personal data:
the right to be informed,
the right to rectification,
the right to restrict processing,
the right to data portability,
the right to object to processing.
4.2 Right to withdraw consent
If you have previously given us your consent to process your personal data, you may also withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing carried out prior to its withdrawal.
4.3 Right to object
If the processing of your personal data is based on a balance of interests (legitimate interest), you have the right to object to such processing at any time for reasons relating to your particular situation. If you exercise your right to object, we would ask you to inform us of the reasons why we should not process your personal data in the way that we do. We will review the situation and either suspend data processing, adapt it or demonstrate to you our compelling legitimate grounds to continue processing your data. We will also continue processing your data if this is necessary for the establishment, exercise or defence of legal claims. You may object to the processing of your data for direct marketing and data analysis purposes at any time. In this case we will cease data processing.
4.4 Exercising your rights
You must notify us in person, by telephone or in writing if you wish to exercise your rights. You should send your request to Swiss Booking AG, Churerstrasse 54, CH-8808 Pfäffikon, tel. +41 (0) 55 588 0238 or via e-mail to email@example.com. We can only provide you with information if you are able to identify yourself.
4.5 Complaining to the supervisory authority
If you believe that the storage and processing of your personal data constitutes a violation of applicable data protection law or breaches your data protection rights, you also have the right to lodge a complaint with the supervisory authority.
5.1 Definition of Cookies
5.2 Types of Cookie
It is possible to distinguish between 4 types of cookie: Essential cookies These cookies are necessary in order to ensure basic website functions. For example these cookies are required if a user puts a product in the basket then moves on to another page and only goes to the checkout at a later stage. Thanks to these cookies, the basket is not emptied, even if the user closes the browser window. Functional cookies These cookies collect information concerning user behaviour and whether the user has received any error messages. In addition, these cookies also measure loading times and how the website performs with different browsers. Targeted cookies These cookies ensure greater user friendliness. For example, they store locations, font sizes or form data that has been entered. Advertising cookies These cookies are also known as targeting cookies. They are intended to provide advertising that is individually tailored to the user. This can be extremely practical, but also very annoying. You are normally asked whether you would like to allow this type of cookie the first time you visit a website. And naturally this decision itself is also stored in a cookie.
5.3 Right to object – ability to delete cookies
Chrome: Clear, enable, and manage cookies
Safari: Manage cookies and website data
Firefox: Clear cookies and site data
Internet Explorer: Delete and manage cookies
Microsoft Edge: Delete and manage cookies
If as a general rule you do not want any cookies, you can configure your browser in such a manner that you are always informed if a cookie is to be saved. You can decide for each individual cookie whether or not to allow the cookie. The procedure differs depending upon the browser. The easiest way of finding instructions is to enter search terms such as “delete cookies Chrome” or “disable cookies Chrome” into Google, if you are using a Chrome browser.
5.4 Legal basis
Since 2009 a so-called “Cookie Directive” has been applicable. It states that the storage of cookies requires your consent (point (a) of Article 6(1) GDPR). However, responses to this Directive within EU Member States have differed widely. In Austria, the Directive was implemented by Section 96(3) of the Austrian Telecommunications Act [Telekommunikationsgesetz, TKG]. Even if consent has not been obtained, essential cookies are justified by legitimate interests (point (f) of Article 6(1) GDPR), which in most cases are economic in nature. We would like to offer a pleasant user experience to visitors to the website, which in many cases means that particular cookies are absolutely essential.
If any cookies are used that are not absolutely essential, this only occurs with your consent. The legal basis for this is point (a) of Article 6(1) GDPR.
6 Google Analytics 6.1 Definition of Goolge Analytics On our website we use the analysis tracking tool Google Analytics (GA) provided by the US company Google Inc. The company Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services within Europe. Google Analytics collects data about how you behave on our website. For example, if you click on a link, this action is stored in a cookie and sent to Google Analytics. We can use the reports that we receive from Google Analytics to tailor our website and our services better to your wishes. We describe the tracking tool in greater detail below and inform you in particular about which data are stored and how you can prevent this from happening. Google Analytics is a tracking tool for analysing data traffic on our website. In order for Google Analytics to work, a tracking code is incorporated into the code for our website. If you visit our website, this code records your various actions on our website. Once you have left our website, these data are sent to Google Analytics servers and stored at that location. Google process the data and we receive reports concerning your user behaviour. These may include, amongst others, the following types of report:
Audience reports: audience reports enable us to find out more about our users and to know who exactly is interested in our services.
Ad reports: ad reports make it easier for us to analyse and improve our online advertising.
Acquisition reports: acquisition reports provide us with helpful information about how we can get
more people interested in our services.
Behaviour reports: here we find out how you interact with our website. We can identify the route by
which you arrived at our website as well as the links that you have clicked on.
Conversion reports: conversion means the way in which you carry out a pre-defined act on the
basis of a marketing message. For example, this might concern how you turn from a mere visitor to the website into a customer or a subscriber to the newsletter. Using these reports we find out more about how our marketing initiatives are received by you. Our aim in doing so is to increase our conversion rates.
Real time reports: here we find out in real time what exactly is happening on our website. For example, we can see how many users are reading this text at any given time.
6.2 The purpose for which Google Analytics is used
We want to offer the best possible service to you. The statistics and data obtained from Google Analytics help us to achieve this goal. After they have been statically assessed, the data provide us with a clear picture of the strengths and weaknesses of our website. First of all, we are able to optimise our website so that it is easier for people who are interested in it to find it on Google. Secondly, the data help us to understand you better as a visitor. This means that we know with a high degree of precision what aspects of our website we have to improve in order to provide you with the best possible service. We also use the data in order to conduct individual, cost- effective advertising and marketing. Ultimately, it only makes sense to display our products and services to people who are interested in them. Using a tracking code, Google Analytics generates a random, unique ID, which is associated with your browser cookie. This enables Google Analytics to recognise you as a new user. The next time you visit our website, you are recognised as a “returning” user. All data collected are stored along with this user ID. This makes it possible to include pseudonymised user profiles in reports. In order to be able to analyse our website with Google Analytics, a property ID has to be embedded in the tracking code. The data are then stored in the corresponding property. Google Analytics 4 Property is used as standard for each newly created property. However, it is still possible to create the Universal Analytics Property as an alternative. Depending upon the property used, data are stored for different periods of time. Your interactions with our website are measured using identifiers such as cookies and app instance IDs. Interactions are types of action that you carry out on our website. If you also use other Google systems (such as e.g. a Google account), data generated using Google Analytics can be cross-referenced with cookies of third party providers. Google does not pass on any Google Analytics data except with our approval as the website operator. Exceptions may apply if required by law.
An overview is provided below of the most important data collected by Google Analytics:
Heatmaps: Google creates so-called “heatmaps”. Heatmaps display specifically the areas that you click on. This allows us to find out where you are browsing on our website.
Session duration: Google defines the session duration as the period of time that you spend on our website without leaving the site. The session ends automatically if you have been inactive for 20 minutes.
Bounce rate: a bounce occurs if you visit only one page on our website and then leave the site again.
Account creation: if you create an account on our website or place an order, Google Analytics collects this information.
IP address: the IP address is only displayed in truncated form in order to prevent it from being uniquely associated with any given user.
Location: the IP address enables the country and your approximate location to be determined. This process is also referred to as IP tracking.
Technical information: technical information includes amongst other things your browser type, your internet provider and your screen resolution.
Referrer: both Google Analytics and we are naturally interested also in finding out via which website or advert you arrived at our website.
6.3 Right to object - right to erasure
6.4 Legal basis
The use of Google Analytics is conditional upon your consent, which we will have obtained via our cookie pop-up. This consent is the legal basis according to point (a) of Article 6(1) GDPR (consent) for the processing of personal data that may be collected by the web analytics tool. In addition to consent, we have a legitimate interest in analysing the behaviour of visitors to the website for the purpose of improving our content in both technical and financial terms. Google Analytics helps us to identify errors within the website, identify attacks and enhance cost-effectiveness. The legal basis for this is point (f) of Article 6(1) GDPR (legitimate interests). Nevertheless, we only use Google Analytics if we have obtained your consent. Google processes data, amongst other locations, also in the USA. Please note that, in the view of the European Court of Justice, at the present time there is not an adequate level of protection for data transfers to the USA. This may entail various risks for the lawfulness and security of data processing. Google uses the standard contractual clauses approved by the EU Commission (Article 46(2) and (3) GDPR) as a basis for data processing by recipients operating in third countries (outside the European Union, Iceland, Liechtenstein and Norway: and thus in particular in the USA) or for the transfer of data to such a country. These clauses oblige Google to maintain the EU level of data protection when processing relevant data, even outside the EU. The clauses are based on an implementing decision of the EU Commission. The decision and the clauses can be found inter alia here: https://ec.europa.eu/info/law/law-topic/data-protection_en.
7 Google Tag Manager
7.1 Definition of Google Tag Manager
On our website we use Google Tag Manager provided by the company Google Inc. The company Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services within Europe. Tag Manager is one of many useful marketing products provided by Google. We can use Google Tag Manager to integrate centrally and manage code fragments of various tracking tools that we use on our website.
In this Privacy Statement we would like to explain to you precisely what Google Tag Manager does, why we use it and in what form data are processed.
7.2 The purpose for which Google Tag Manager is used
Google Tag Manager itself does not store any cookies, but rather manages tags from various tracking websites.
7.3 Legal basis
The use of Google Tag Manager is conditional upon your consent, which we will have obtained via our cookie pop-up. This consent is the legal basis according to point (a) of Article 6(1) GDPR (consent) for the processing of personal data that may be collected by the web analytics tool. In addition to consent, we have a legitimate interest in analysing the behaviour of visitors to the website for the purpose of improving our content in both technical and financial terms. Google Tag Manager enables us to enhance cost-effectiveness. The legal basis for this is point (f) of Article 6(1) GDPR (legitimate interests). Nevertheless, we only use Google Tag Manager if we have obtained your consent. Google processes data, amongst other locations, also in the USA. Please note that, in the view of the European Court of Justice, at the present time there is not an adequate level of protection for data transfers to the USA. This may entail various risks for the lawfulness and security of data processing. Google uses the standard contractual clauses approved by the EU Commission (Article 46(2) and (3) GDPR) as a basis for data processing by recipients operating in third countries (outside the European Union, Iceland, Liechtenstein and Norway: and thus in particular in the USA) or for the transfer of data to such a country. These clauses oblige Google to maintain the EU level of data protection when processing relevant data, even outside the EU. The clauses are based on an implementing decision of the EU Commission. The decision and the clauses can be found inter alia here: https://ec.europa.eu/info/law/law-topic/data-protection_en. If you would like to find out more about Google Tag Manager, we recommend that you consult the FAQs at https://support.google.com/tagmanager/?hl=en#topic=3441530.
8 Information About Data Transfers to Third Countries or International Organizations
The data processed by us are not transmitted to recipients in third countries or to international organisations.